Executive brief
A security vulnerability exists in a popular PHP file upload library used by various web applications, including the K2 extension for Joomla. The software fails to block certain dangerous file types, which could allow an attacker to upload and execute malicious code on the server. This could lead to a complete takeover of the website, theft of sensitive data, or disruption of services.
Technical details
The class.upload.php library (through 1.0.3 and 2.0.4) utilizes a blacklist-based approach to filter dangerous file extensions. It omits the '.pht' extension from this list, which is a valid PHP execution handler on many server configurations (particularly Debian/Ubuntu). An unauthenticated remote attacker can bypass the filter by uploading a specially crafted image file containing a PHP payload with a .pht extension. While the library performs image transformations that typically destroy payloads, researchers have demonstrated that a brute-force approach can identify images where the payload survives processing, leading to Remote Code Execution (RCE). The issue is resolved in version 2.0.5.
Affected products
- verot.net class.upload.php <= 1.0.3, 2.0.0 - 2.0.4
- JoomlaWorks K2 <= 2.10.1
Timeline
- 2019-12-07: disclosed: Reported to developer and JoomlaWorks
- 2019-12-07: patched: Developer released a patch in version 2.0.5
- 2019-12-17: advisory: NVD published CVE-2019-19634
- 2020-02-28: advisory: GitHub Advisory published
References
- https://github.com/jra89/CVE-2019-19634
- https://github.com/verot/class.upload.php/blob/2.0.4/src/class.upload.php
- https://medium.com/@jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e
- https://medium.com/%40jra8908/cve-2019-19634-arbitrary-file-upload-in-class-upload-php-ccaf9e13875e